[gaborbernat]

Releasing pytest-print used to depend on bash written into this repo's workflows: it bumped the version from a dropdown, pasted fragment files into CHANGELOG.md and built the GitHub Release text with awk. This PR hands that work to tox-dev/github-workflows 6.0.1 and release-creator 4.1.0. 🚀 A maintainer dispatches 🏷️ Prepare release; with the default auto bump the version follows the pending Towncrier fragments, and the changelog credits the commit authors and co-authors and lists first-time contributors.

Contributors see the change in two places. The new CONTRIBUTING.md, linked from the README, lists the ten fragment categories, says which ones select a minor or major version, and asks for no hand-written credits. The 19 existing changelog sections are rewritten into those categories with stable anchors and author credits; entries that only covered CI, tooling or refactors are gone, so 1.2.1 and 1.2.2 keep only their headings.

Architecture

The shared prepare workflow splits the work in two. A read-only job builds the changelog and uploads a release patch; a second job in the release-auth environment, which deploys only from main, applies that patch, creates a GitHub App token and pushes the commit and tag. The App key never reaches the job that runs Towncrier and the hooks.

The tag starts release.yaml, which runs one release at a time per tag. The shared build makes the wheel and sdist against the locked build backend while a read-only job renders the GitHub Release body from the tagged changelog section. PyPI publishing uses trusted publishing with attestations. The last job compares every built file with PyPI and checks its attestation, then publishes the GitHub Release.

flowchart LR
    Dispatch[Prepare release dispatch] --> Assemble[Assemble changelog, read-only]
    Assemble --> Push[Push commit and tag, release-auth]
    Push --> Build[Build wheel and sdist]
    Push --> Notes[Render release notes]
    Build --> PyPI[Publish to PyPI]
    Notes --> GHR[Verify PyPI files, publish GitHub Release]
    PyPI --> GHR
    classDef ro fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef write fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
    class Dispatch,Assemble,Build,Notes ro;
    class Push,PyPI,GHR write;

Loading

Checks that only caught a mistake by someone with write access are gone: prepare no longer requires refs/heads/main, and the tag run no longer checks the tag's shape or the distribution file names. The fork guard on github.repository stays. The news check moves to its own 📝 Changelog workflow, which requires a fragment on human PRs, so 🚦 Required checks pass now gates only the test matrix. Each workflow, job and step gets an emoji name.

Dependencies

pylock.toml, generated by Nab 0.0.22 for CPython 3.15 on linux_x86_64, pins the release tools, including release-creator 4.1.0. The build group locks the hatchling backend plus Cython and setuptools, since PyYAML is locked as an sdist only. release-creator 4.1.0 is newer than the seven-day upload cutoff, so [tool.nab] carries an exception for it. A weekly 🔒 Upgrade release tools workflow opens the relock PR. The tox environments still install their dependency groups without the lock.

Hook updates move to Dependabot's pre-commit ecosystem, weekly on Tuesday with a seven-day cooldown, and pre-commit.ci autoupdates quarterly. Hooks are pinned to frozen commit SHAs, and mdformat comes from its upstream repo with pinned plugins. The PyPI page now renders the README through hatch-fancy-pypi-readme, so its CHANGELOG.md and CONTRIBUTING.md links point at GitHub. The metadata switches to an SPDX license and adds Framework :: Pytest.

🛡️ CodeQL

CodeQL moves from default setup to a committed workflow on ubuntu-26.04 scanning Python and the workflows with the security-extended suite and skipping tests/, which removes the ubuntu-latest migration notice default setup produces.